These scams work by manufacturing panic: a loud, official-looking warning that something is terribly wrong and you must act now. The whole trick is to get you to call, click, or hand over control before you have time to think. Once you know the pattern, it falls apart — there's a short list of things that are always true.
What these scams look like
- The pop-up: a full-screen "Windows Defender" or "Apple Security" alert, sometimes with beeping or a robotic voice, "do not restart your computer," and a phone number to call.
- The call: someone claiming to be Apple, Microsoft, your internet provider, or "the refund department" about a virus or a charge you didn't make.
- The fake receipt: an email or text confirming a purchase or renewal you never made, with a number to call to "cancel."
The common thread is always the same: urgency, a phone number, and a demand to call, install, or pay. That combination is the scam's signature.
Things that are always true
Hold onto these and you can't be fooled:
- Apple, Microsoft, Google, and your bank will never cold-call you about a virus or a refund.
- Real virus warnings never give you a phone number to call. Legitimate security software just quietly handles or quarantines things.
- A website cannot scan your computer. Any page claiming to have "detected" infections is bluffing.
- No real company takes gift cards, crypto, or wire transfers for support or refunds. Ever.
What to do if you're looking at one
- Don't call the number and don't click anything in the pop-up — even the "X" or "Close" can be part of the trap.
- Leave full-screen first if it's taken over the screen (press Esc, or move the mouse to the top and exit full-screen).
- Close the tab. If it won't close, force-quit the whole browser — Mac: Cmd+Option+Esc; Windows: Ctrl+Shift+Esc, then End task on the browser.
- Reopen the browser without restoring tabs. If it keeps coming back, clear the browser's recent history and site data.
That's it. A pop-up you didn't act on can't do anything — closing it ends the threat.
If you called, installed, or paid
Don't panic, and don't feel foolish — these are designed to fool sharp people. Act in this order:
- If you gave remote access (they had you install something like AnyDesk or TeamViewer): disconnect from Wi-Fi or unplug the internet now, and power the computer off if you're unsure.
- Uninstall any program they had you add, and change your important passwords from a different device — email and bank first — then turn on two-factor authentication.
- If money or card details were shared: call your bank or card company directly, using the number on your card, and tell them. For gift cards, contact the card's issuer right away — sometimes funds can be frozen.
- Have the computer checked for anything they left behind.
Telling a real problem from a scam
- Real malware is usually quiet: a slow computer, browser redirects, or strange new extensions — not a flashing number to call.
- Security software you chose runs in the background; it doesn't seize the whole screen and demand a phone call.
- When unsure, never use the contact info in the message. Look the company up yourself, or text a local person you trust before doing anything.
- What the message or caller said (a photo of the screen helps)
- Whether you called, installed anything, or gave remote access
- Whether any money or bank details were shared
- The device and the browser you were using
Clicked or called something?
Tell me what happened — no judgment. I'll help you lock things down and check the machine for anything left behind.
Common questions
Is the "your computer is infected" pop-up a real virus?
No — it's a scare-tactic web page, and a website can't actually scan your computer. The pop-up itself can't hurt you; the danger is only if you call the number, install what it says, or give someone remote access.
Microsoft or Apple called about a virus — is it real?
No. They don't make unsolicited calls about viruses or refunds. Hang up. If you want to be sure, look up the company's real number yourself rather than using any number the caller gave you.
I gave a "technician" remote access — what now?
Disconnect from the internet, uninstall any remote tool they had you install, then change your passwords from a different device — email and bank first — and turn on two-factor authentication. Have the computer checked, and if money was involved, call your bank directly.
They asked me to pay with gift cards — is that ever legitimate?
Never. No real company or agency takes gift cards, crypto, or wire transfers for support or refunds. It's a definitive sign of a scam.